Skip to content
cronpad
AI integration / Agent skill

Agent skill

A skill is a folder of instructions that an AI agent loads when a task matches it. The cronpad repository ships one at skills/cronpad/SKILL.md. It tells the agent how to authenticate, which schedule syntax to use, the safe order of operations, how to verify webhook signatures in common languages, and how to debug a failing job from its runs and attempts.

Install

Copy the folder into wherever your agent reads skills from (for example a project’s skills directory), or point the agent at the file directly:

curl -fsSL https://raw.githubusercontent.com/gowthamgts/cronpad/main/skills/cronpad/SKILL.md -o skills/cronpad/SKILL.md

The skill expects CRONPAD_URL and CRONPAD_API_KEY in the environment, and uses the MCP server when connected, or the CLI with --json otherwise.

What the skill teaches

  1. The model. Jobs, occurrences, runs and attempts, what start lag measures, and why delivery is at-least-once, so the agent can explain “it ran twice” or “it ran late” correctly.
  2. Which tool to use. A map from each task to its MCP tool, CLI command and REST endpoint, including the scope each needs and the few things only REST can do (testing a destination before a job exists, re-enabling an auto-disabled job, retrying a run).
  3. Validate, preview, confirm, then create. Never create a job from an unverified schedule; show the next fire times in the user’s IANA timezone first, then optionally test the destination once.
  4. Every job option. Retry policy, timeout, misfire and overlap policies, SLA threshold, auto-disable threshold and secret references, with the server defaults.
  5. Make receivers idempotent with the request headers listed and ready-made signature verification snippets.
  6. Debug from evidence. A symptom table for “never ran”, “skipped”, “ran twice”, “ran late”, receiver errors and auto-disabled jobs, read from runs and attempts rather than guessed.
  7. Don’t delete; pause. Prefer pause_job unless the user explicitly asks to delete.
  8. Self-hosted operations. What /readyz reports, the rebuildable queue file, opt-in Litestream backups and single-format logs.

Receiver verification

The skill contains Go, Node and Python functions that verify Standard Webhooks HMAC-SHA256 signatures over exact raw body bytes, check a five-minute timestamp tolerance, and accept any valid signature during key rotation. Repository tests extract and execute all three snippets against a real signed cronpad delivery, including tampered bodies, stale timestamps and malformed signatures. Store the signing secret in the receiver; MCP never returns it. Deduplicate Idempotency-Key durably after verification.

Repository tests also parse every schedule example in the skill with cronpad’s own parser, and check that the skill names every MCP tool and no tool that doesn’t exist. The skill includes cron, seconds-first cron, Quartz, natural language, RRULE and one-off examples, plus timezone guidance. It documents scopes, JSON CLI fallbacks, command jobs, custom MCP paths, and the run/attempt debugging flow.